Privacy Policy

The controller of the personal data described in this policy is Quetzal Tech, S.L. (Sociedad Unipersonal), registered office Alameda Principal, 24, planta 1ª, puerta 3, 29005 Málaga, España, contactable at hello@quetzaltech.es. Full company identification is in the Legal Notice.

We have not appointed a Data Protection Officer, as we are not required to. Data protection questions go to the address above and are handled by the company’s director.

Account data. Your email address, name and authentication details when you create an account.

Connected social accounts. When you connect Instagram, Facebook, LinkedIn, TikTok, X or YouTube, the platforms grant us OAuth access tokens. These tokens are stored encrypted in a dedicated secrets vault — never in plaintext — and are used exclusively to publish the content you approve and to read the performance of your own posts.

Content and performance metrics. The briefs you write, the drafts Quetzal generates, the assets you upload, and the engagement metrics of your published posts (collected at 1, 6, 24 and 72 hours after publishing).

Billing data. If you subscribe to a paid plan, our payment processor collects your payment details directly. We receive and store the subscription status, plan and invoice records, never your full card number.

When you connect an account, we receive from that platform only what the permissions you granted allow, and only for the account you connected: the profile identity (account or page name, ID and avatar), the ability to publish content you have approved, and the metrics of your own published posts (impressions, reactions, comments, shares, clicks, follower counts). Where you enable comment or message automation, we also receive the comments and messages sent to your account so the feature can respond.

We use this data solely to provide the features you turned on, inside your own workspace. We do not use it to build advertising profiles, we do not combine it with data from other customers to identify individuals, and we do not transfer it to any party other than the processors listed below. Our use of information received from Meta APIs follows the Meta Platform Terms and Developer Policies, and equivalent terms apply for every other connected platform.

Disconnecting an account revokes our tokens immediately and stops all further collection. Deleting your workspace erases the data already received, as described under data deletion.

To provide the service — generating drafts in your brand voice, scheduling and publishing what you approve, measuring how it performs. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

To improve your results — your own consented performance metrics inform which content the system proposes to you next. Legal basis: performance of our contract, and your consent where you enable optional data sharing (Art. 6(1)(a) and 6(1)(b) GDPR).

To keep the service secure and working — authentication, abuse prevention, error diagnosis, safety filtering. Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

To bill you and meet our obligations — invoicing, tax and accounting records. Legal basis: performance of contract and compliance with a legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).

External platform data is used as context at drafting time only and is never trained into model weights.

Quetzal uses AI models to draft captions, images and video from your briefs and brand materials. These are content suggestions, not decisions about you: nothing is published without your approval, and no automated processing produces a legal or similarly significant effect on you within the meaning of Art. 22 GDPR. Where the autopilot is enabled, you authorise publication in advance through the settings you control, and you can withdraw that authorisation at any time.

We do not sell your data. We do not share your content or metrics with advertisers. We do not publish anything without your approval or your configured autopilot mandate.

We rely on a small set of processors to run the service, each receiving only the data needed for its function and each bound by a data-processing agreement: cloud hosting and application delivery, database, authentication and encrypted secret storage, background job execution, dedicated render and analysis servers, AI model providers for text, image, video and speech generation, a social publishing aggregator for platforms we do not yet serve natively, payment processing, and transactional email delivery.

Our infrastructure is hosted in the European Union. Some AI model and payment providers process data in the United States; those transfers are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can request the current list of processors and the transfer safeguards in place at hello@quetzaltech.es.

Access tokens and secrets are encrypted at rest in a dedicated vault, never stored in plaintext and never exposed to the browser. Every workspace is isolated at the database level, so one customer’s data cannot be read from another’s session. Access to production data is limited to what operating the service requires.

You can request access to the personal data we hold about you, ask for it to be rectified or erased, obtain a portable copy, restrict or object to processing, and withdraw any consent you have given — withdrawal does not affect processing already carried out. Email hello@quetzaltech.es and we will respond within 30 days.

You can also delete your data yourself at any time; see data deletion. If you believe we have handled your data improperly you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or with the authority of your own country of residence.

We keep your data for as long as your account is active. When you delete your workspace or account, your posts, connections, assets and analytics are removed. Encrypted tokens for disconnected accounts are deleted at disconnection time. Invoicing and tax records are kept for the period Spanish law requires, currently six years, because we are obliged to.

Quetzal is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, write to us and we will remove it.

Strictly necessary cookies keep the product working and are always on: a session cookie that keeps you signed in, plus q-lang (your language preference) and q-theme (light or dark mode). These don’t require consent.

Analytics cookies are optional and off by default — we load them only if you opt in through the cookie banner. We currently use no analytics or advertising cookies at all. Your choice is stored in a q-consent cookie; change it anytime via “Cookie settings” in the footer.

When we change this policy we update the date at the top. If a change materially affects how we handle your data, we tell you in the product or by email before it takes effect.

Questions about this policy: hello@quetzaltech.es.